Hello, in this post, we will do network traffic analysis of an exercise IT’S A TRAP.

DETAILS OF LAN SEGMENT

  • LAN segment range: 10.6.13[.]0/24 (10.6.13[.]0 through 10.6.13[.]255)
  • Domain: massfriction[.]com
  • Active Directory (AD) domain controller: 10.6.13[.]3 - WIN-DQL4WFWJXQ4
  • AD environment name: MASSFRICTION
  • LAN segment gateway: 10.6.13[.]1
  • LAN segment broadcast address: 10.6.13[.]255

We load the PCAP file in Snort to list the alerts it would have triggered,

Snort alert count
Figure 1: Snort alert count

The alert count is 138. Let’s view the type of alerts,

The port scanning alert seems interesting.

Alert port scanning
Figure 2: Alert port scanning

Multiple HTTP URI alerts were also observed. Typically, either to and fro from 10.6.13.133.

Alert HTTP URI
Figure 3: Alert HTTP URI

After we analyze the DNS entries, we find some entries that might be suspicious.

DNS queries part 1
Figure 4: DNS queries part 1
DNS queries part 2
Figure 5: DNS queries part 2
DNS queries part 3
Figure 6: DNS queries part 3

The Virustotal results confirms we are on the right track.

Suspected URL 1
Figure 7: Suspected URL 1
Suspected URL 2
Figure 8: Suspected URL 2
Suspected URL 3
Figure 9: Suspected URL 3
Suspected URL 4
Figure 10: Suspected URL 4
Suspected URL 5
Figure 11: Suspected URL 5
Suspected URL 6
Figure 12: Suspected URL 6
Suspected URL 7
Figure 13: Suspected URL 7
Suspected URL 8
Figure 14: Suspected URL 8
Suspected URL 9
Figure 15: Suspected URL 9

All these outbound connections were originating from 10.6.13.133 (The Snort log also had the same IP for HTTP URI alerts Ref. fig. 2).

We now analyze HTTP requets from the same IP address,

Suspicious outbound request
Figure 16: Suspicious outbound request

BINGO!, The very first request made to one of the suspicious entries contains PowerShell as the user agent. We follow the request in HTTP stream,

Powershell script in stream
Figure 17: Powershell script in stream

The response contains a PowerShell script. Let’s view the script,

Powershell script 1
Figure 18: Powershell script 1

Most of the lines are dead code. example,

for ($i = 0; $i -lt 5; $i++) { $nextvar = $i }
try { $y = 0 } catch { $error }
if ($errorLevel -gt 7) { Write-Output ‘$result’ }
while ($binpath) { Start-Sleep -Seconds 0 }

We mark all of them similarly to the above pattern,

Dead code in powershell script 1
Figure 19: Dead code in powershell script 1

We removed redundant lines,

Cleaned powershell script 1
Figure 20: Cleaned powershell script 1

Insight (From fig. 20):

  1. The first blob contains base64 encoded strings that are being concatenated later.
  2. The second string contains powershell command to convert from base64.
  3. The third string executes the decoded base64 script.

We use the following recipe to extract base64, concatenate them, and decode them.

Regular_expression('User defined','\\s=\\s"(.*?)"',true,true,false,false,false,false,'List capture groups')
Find_/_Replace({'option':'Extended (\\n, \\t, \\x...)','string':'\\n'},'',true,false,true,false)
From_Base64('A-Za-z0-9+/=',true,false)

We load the recipe in CyberChef,

Decoded base64 of powershell script 1
Figure 21: Decoded base64 of powershell script 1

The decoded base64 contains another PowerShell script. Let’s view it.

Powershell script 1.1
Figure 22: Powershell script 1.1

After deobfuscation, the script we get,

Deobfuscated powershell script 1.1
Figure 23: Deobfuscated powershell script 1.1

The output of the command systeminfo is passed as a POST request to the URL “eventdata-microsoft[.]live/NV4RgNEu”.

We could see an outbound request being made to this uncovered URL.

Outbound request made by powershell script 1.1
Figure 24: Outbound request made by powershell script 1.1

We could see the systeminfo output in the TCP stream,

System info in post request
Figure 25: System info in post request

Additionally, we could see another PowerShell script as a response from the server,

Powershell script 2 in stream
Figure 26: Powershell script 2 in stream

let’s view this script

Powershell script 2
Figure 27: Powershell script 2

This PowerShell script seems extremely obfuscated, spanning over 13K lines of code. Deobfuscating this lengthy script is near impossible until…

We use bankai!

Bankai!
Bankai!

We mark the redundant lines as similar to the previous one.

Dead code in powershell script 2
Figure 28: Dead code in powershell script 2

Removing them, we are left with.

Cleaned powershell script 2
Figure 29: Cleaned powershell script 2

We could observe same pattern of script containing base64 blobs being concatenated and invoked. We use the same CyberChef recipe as earlier.

Decoded base64 of powershell script 2
Figure 30: Decoded base64 of powershell script 2

We could observe another obfuscated PowerShell script as output,

Powershell script 2.1
Figure 31: Powershell script 2.1

When deobfuscated, we get a readable PowerShell script as,

Deobfuscated powershell script 2.1 part1
Figure 32: Deobfuscated powershell script 2.1 part1

Insight (From fig. 32):

  1. The php binaries for Windows are being downloaded from the URL in %temp% locations as php.zip.
  2. Then the downloaded zip is extracted to ApplicationData\php directory.
  3. After extraction, the file is deleted from the %temp% location.
  4. The config and php binary absolute paths are set to,
    • $mv = ApplicationData\php\config.cfg
    • $YupgDUknfb = ApplicationData\php\php.exe
  5. We could see another base64 encoded string stored in a variable, $X9.
Decoded base64 of powershell script 2.1
Figure 33: Decoded base64 of powershell script 2.1

The decoded base64 contains obfuscated php script.

Deobfuscated powershell script 2.1 part2
Figure 34: Deobfuscated powershell script 2.1 part2

Insight (From fig. 34):

  1. The first section decodes the base64 data (containing php script) and writes to a file ApplicationData\php\config.cfg pointed by the variable $mv .
  2. The second section executes the obfuscated PHP script using the official PHP binary downloaded earlier and extracted in ApplicationData\php folder. The output of the executed php file is written in two files, pointed by $UZ3eaxi6FRJQ0yaCX and $GhzCP .
  3. The content of those is stored in $lMeQbHXUc and $2oRVdufAtTxwFJB .
  4. After the content is stored, the created files are deleted.
  5. The third section sends the data as a POST request to the URL “comprehensive-cabin-spend-organic[.]trycloudflare[.]com/NV4RgNEu” after concatenation via a delimiter “-=-=-=-=-=-“.

We can get the MAC address and hostname using DHCP protocol.

DHCP protocol
Figure 35: DHCP protocol

For the user account name, we use kerberos protocol.

Kerberos protocol
Figure 36: Kerberos protocol

QUESTIONS? ANSWERS

  • What is the IP address of the infected Windows client? 10.6.13.133
  • What is the mac address of the infected Windows client? 24:77:03:AC:97:DF
  • What is the host name of the infected Windows client? DESKTOP-5AVE44C
  • What is the user account name from the infected Windows client? rgaines

We meet next time dissecting another sample or comming up with an evasion technique until then Nabad gelyo.